Hello, I'm back with another question. From my understanding split function is used to split lets say messages into multiple lines of code and then you use grok to parse this into a single list of variables. However what Im trying to do is divide my log file containing multiple events into single events starting with keyword1 and ending with keyword2 and parse these with grok. Is this even possible ? Should I split the field externally and send in the separate events ?
I would like to input 1 file , resulting in for example 5 events each parsed with grok and each having its own output.